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AB - One embodiment of the present invention provides a method and an 

apparatus that facilitates transparent failovers from a primary copy 
(206) of an object on a first server (212) to a secondary copy (216) 
of the object on a second server (213) when the first server fails , or 
otherwise becomes unresponsive. The method includes detecting the 
failure of the first server; selecting the second server; and 
reconfiguring the second server to act as a new primary server for the 
object. Additionally, the method includes transparently retrying 
uncompleted invocations to the object to the second server, without 
requiring explicit retry commands from a client application program. A 
variation on this embodiment further includes winding up active 
invocations to the object before reconfiguring the second server to 
• act as the new primary server. This winding up process may include 
causing invocations to unresponsive nodes to unblock and complete. 
Another variation includes blocking new invocations to the object 
after detecting the failure of the first server, and unblocking these 
new invocations after reconfiguring the second server to act as the 
new primary server. Hence, the present invention can greatly simplify 
programming of client application programs for highly available 
systems. It also makes it possible to use a client application program 
written for a non-highly available system in a highly available 
system. 


